What YARD Stick One Is

YARD Stick One is a sub-1 GHz wireless transceiver from Great Scott Gadgets. It operates on a single frequency range: 300–928 MHz, a sweet spot where many wireless systems live.

The device covers several frequency bands. The 433 MHz ISM band is within range, used by European IoT sensors, key fobs, garage door openers, and weather stations. The 868 MHz band is also covered, used by EU sub-GHz IoT devices such as Z-Wave and LoRa sensors, plus alarm systems.

In the US, the 915 MHz band is where LoRa and some ZigBee systems operate, as well as industrial systems.

YARD Stick One costs around $100, cheaper than HackRF One. It does full-duplex operation. However, it does not support WiFi, Bluetooth, LTE, or GPS, and its range stops at 928 MHz.

The Sub-1 GHz Ecosystem

The 300-928 MHz range is crowded. Infrastructure often gets overlooked.

Key fobs and remote access systems transmit at 315 or 433 MHz in the US, 433/868 MHz in the EU. Fixed codes can be replayed easily; rolling codes need deeper analysis.

Cheap IoT sensors send unencrypted data on 433 MHz. The YARD Stick One can monitor this passively, providing valuable insights.

The Z-Wave smart home mesh operates on 908 MHz in the US, 868 MHz in the EU. Security professionals use the YARD Stick One for RF work with Z-Wave gear.

Industrial telemetry systems in utilities, agriculture, factories send unencrypted data on 433/868/915 MHz.

TPMS sensors in US cars, post-2008, broadcast IDs and pressure data on 315 or 433 MHz. These IDs track vehicles.

RFCat Interface

YARD Stick One Control

The YARD Stick One uses RFCat for control. It's a Python library, built alongside the hardware. The library is command-line and scripting focused, with no GUI.

To use RFCat, you follow a workflow that starts with importing the RfCat class from the rfcat library. You then create an instance of RfCat, set the frequency to 433.92 MHz, set the modulation to ASK OOK, set the data rate to 2400 baud, and set the maximum power.

Interacting with the YARD Stick One involves using Python. The basic steps are to set the frequency, modulation, and data rate, then transmit. Scripts do the work, as there is no graphical interface. This approach suits some users, not others.

Receive

data = d.RFrecv()

Transmit

d.RFxmit(bytes.fromhex('deadbeef'))

## Introduction to RFCat and URH

RFCat has a Python interface; you write scripts to control it. 
The tool does not ship with a graphical interface for point-and-click users.

## GUI Alternative: URH

URH offers a GUI, a visual tool for working with the YARD Stick One. 
The tool provides signal capture, protocol analysis, and modulation identification. 
You interact with URH through a graphical interface.

## Full-Duplex vs. HackRF

YARD Stick One transmits and receives at the same time. HackRF One can't. It's half-duplex, so it's either sending or listening.

In OSINT, this matters little, you're usually just listening or just testing. Not both. But for some jobs, like digging into two-way protocols, full-duplex helps.

## Comparison to Alternatives

The RTL-SDR V4, which costs around $40, is a receive-only device that cannot transmit. It works well for 433 MHz sensor monitoring and is a cheap option. 

The YARD Stick One has transmit capability, setting it apart from the RTL-SDR V4.

The HackRF One, priced at around $340, offers broader spectrum coverage, but is more expensive. For sub-GHz work, the YARD Stick One is more cost-effective.

The Flipper Zero, costing around $170, is cheaper and comes with a screen, making it easy to use. However, it lacks precision. The YARD Stick One provides more control and allows for deeper analysis, making it suitable for research and scripting. The Flipper Zero is better suited for field testing.

## Practical Use Cases

**IoT device inventory**: 433 MHz devices broadcasting in a building are captured passively. This is relevant for physical security.

Devices communicate with each other, and you listen.

**Key fob analysis**: Analyzing a key fob's signal involves identifying the modulation and frequency, then capturing it to determine if it's a fixed or rolling code.

Knowing this information is crucial.

**Protocol reverse engineering**: Unknown sub-GHz protocols exist, particularly in industrial gear and legacy systems. These are captured and analyzed using Universal Radio Hacker.

Details are obtained through this process.

**RF emissions mapping**: To determine what is transmitting in a given area, a systematic approach is used. This involves conducting RF hygiene audits and security assessments.

The spectrum is mapped through this process.

## Legal Framework

The HackRF legal caveats apply here too. Passive reception is usually fine. Transmitting on licensed frequencies without a permit is illegal almost everywhere.

The sub-GHz ISM bands, 433 MHz, 868 MHz, 915 MHz, are unlicensed. Low-power signals within FCC or ETSI limits are acceptable. You can legally transmit. 

Replaying a device in a lab for research purposes is one thing; doing it to a neighbor's garage door opener is another. That is not research.

---

*Reviewed April 2026. The Yardstick One is available at greatscottgadgets.com/yardstickone and on Amazon.*

---

## See Also

- [Best Budget SDR Setup (Under $50, $100, and $300)](/comparisons/best-budget-sdr-setup)


## Further Reading

- [YARD Stick One on GitHub](https://github.com/greatscottgadgets/yardstickone)
- [RFCat firmware documentation](https://github.com/atlas0fd00m/rfcat)